| 1 | Remote Code Loading | critical | js/gtm.js (line 1) | The Google Tag Manager snippet dynamically creates and injects a script element that loads arbitrary JavaScript from googletagmanager.com at runtime with container ID GTM-KNZ6CR7. GTM containers can be modified at any… | |
| 2 | Remote Code Loading | critical | js/gtm.js (line 1) | The background page dynamically injects a remote script from Google Tag Manager (container GTM-KNZ6CR7) at runtime. GTM containers can be reconfigured at any time by the container owner to push arbitrary JavaScript in… | |
| 3 | Data Exfiltration | high | js/onesignal.js (line 269) | The extension enumerates the user's in-app purchase history via google.payments.inapp.getPurchases and exfiltrates SKUs, currency codes, and purchase amounts to the OneSignal API endpoint /players/{id}/on_purchase. Se… | |
| 4 | Data Exfiltration | high | js/onesignal.js (line 269) | The extension enumerates the user's active Google in-app purchases (SKU, currency code, and exact purchase price) and exfiltrates this financial data to OneSignal's servers via `POST /api/v1/players/{id}/on_purchase`.… | |
| 5 | Obfuscation | high | js/onesignal.js (line 36) | A minified/obfuscated block uses execScript and single-letter variable names throughout, and connects to a hardcoded external extension ID (nmmhkkegccagdldgiimedpiccmgmieda) via chrome.runtime.connect for payment proc… | |
| 6 | Phishing | high | js/onesignal.js (line 418) | Incoming GCM/FCM push messages can contain an arbitrary URL in the custom payload's 'u' field; when a notification is clicked, this URL is opened in a new tab via chrome.tabs.create with no validation or allowlist che… | |
| 7 | Privilege Escalation | high | js/background.js (line 78) | The extension silently enables Flash (plugins contentSetting) for an extensive list of domains on install without any user prompt or notification. Flash has well-documented critical security vulnerabilities, and enabl… | |
| 8 | Privilege Escalation | high | js/background.js (line 78) | On every install and update, the extension silently enables the Adobe Flash plugin (`contentSettings.plugins: 'allow'`) for over 40 domains without any user notification or consent. Flash is an end-of-life technology … | |
| 9 | Unauthorized Data Collection | high | js/onesignal.js (line 153) | The extension calls chrome.identity.getProfileUserInfo to obtain the user's Google account ID and sends it as 'ad_id' along with a full device fingerprint (platform, OS version, language, timezone, FCM registration ID… | |
| 10 | Unauthorized Data Collection | high | js/background.js (line 128) | The extension initializes the OneSignal push notification SDK using the identity permission, which causes the user's Google account ID to be transmitted to OneSignal's servers for advertiser identification. The permis… | |
| 11 | Unauthorized Data Collection | high | js/onesignal.js (line 153) | The extension uses `chrome.identity.getProfileUserInfo` to obtain the user's Google account ID and transmits it as `ad_id` (advertising identifier) to OneSignal's tracking servers at `https://onesignal.com/api/v1/play… | |
| 12 | Code Injection | medium | manifest.json (line 16) | The extension manifest declares `'unsafe-eval'` in its Content Security Policy, disabling the primary runtime code-injection protection for extensions. Combined with the GTM remote-script loader, this means any JS rea… | |
| 13 | Tracking | medium | js/app.js (line 28) | This function calls OneSignal.sendTags() to transmit metadata about the user's extension installation (including version number) to OneSignal's external servers, associating the user's push subscriber profile with the… | |
| 14 | Tracking | medium | js/gtm.js (line 1) | The GTM loader pushes a timestamped start event to window.dataLayer and loads tracking infrastructure from Google's servers, enabling behavioral tracking of user interactions with the extension. Data collected by GTM … | |
| 15 | Unauthorized Data Collection | medium | js/background.js (line 112) | The extension responds to external messages from any origin without validating the sender, disclosing internal state (extension presence, Flash status, install recency). Any website can query this to fingerprint users… | |
| 16 | Tracking | low | js/background.js (line 112) | The extension responds to `onMessageExternal` from any of ~40 externally-connectable origins by confirming the extension is present and that Flash is enabled (`flash: true`). While the allowed origins are all Poki-con… | |
